mirror of
https://github.com/coturn/coturn.git
synced 2026-10-24 00:08:57 +03:00
ce26268da8
## What The DTLS client listeners are no longer started by default. They come up only when `--dtls` is given. Until now DTLS came up automatically whenever usable certificates were configured, so every deployment that wanted TLS also exposed a DTLS handshake path it had never asked for. That path is the most expensive unauthenticated entry point the server has: it builds an `SSL` object, an `ioa_socket` and a session *before* the DTLS cookie is verified. Deployments that do not serve DTLS clients were paying for that surface silently. ## Compatibility `--no-dtls` keeps its meaning, including `--no-dtls=false` to ask for DTLS, so an existing configuration resolves to exactly the listeners it asked for. Both spellings now log a deprecation warning naming `--dtls`: ``` CONFIG: --no-dtls is deprecated and now redundant: DTLS listeners are not started unless --dtls is given CONFIG: --no-dtls=false is deprecated: use --dtls to start the DTLS listeners ``` **This is a behaviour change for anyone who relied on the old default.** A deployment that configured certificates and passed no DTLS flag loses its DTLS listeners on upgrade. The only signal such an operator gets is a startup line, emitted when the certificates are usable but DTLS is off: ``` DTLS listeners are not started; use --dtls to start them ``` If the project would rather have a transition release — default unchanged, but logging that it is about to change — that is a small edit to this branch; say so in review. ## How `turn_params` carries the state as `dtls` rather than the previous `no_dtls`, so the listener and netengine tests read as "DTLS is on" instead of double negatives, and `openssl_setup()`'s two-flag guards lose their De Morgan wrapper (`!(no_tls && no_dtls)` becomes `!no_tls || dtls`). The telnet CLI and web admin listings consequently report `dtls` instead of `no-dtls`, matching the flag an operator actually sets. Documentation follows in `README.md`, `README.turnserver`, the built-in help and `examples/etc/turnserver.conf`. The `--pkey` help entry had a sentence truncated mid-clause; the rewrite fixes it. ## Tests New `examples/run_tests_dtls_default.sh` pins four cases: - no flag: no DTLS context, the hint line is logged, and a `turnutils_uclient -S` session cannot complete; - `--dtls`: context created, DTLS client relays end to end; - `--no-dtls`: warns, stays off; - `--no-dtls=false`: warns, starts DTLS, client relays. It is wired into all four workflows, so this default is now covered on both Linux and macOS. Example scripts that only ever wanted DTLS off drop the now-redundant flag; the ones that drive DTLS clients pass `--dtls`. Also run green: `ctest` (18/18 macOS, 17/17 Linux) and, on both platforms where applicable, `run_tests.sh`, `run_tests_conf.sh`, `run_tests_multiplex_peer.sh`, `run_tests_stateless_nonce.sh`, `run_tests_stateless_binding.sh`, `run_tests_ratelimit_401.sh`, `run_tests_mobile.sh`, `run_tests_rfc5780.sh`, `run_tests_expiry.sh`; fuzzing smoke tests (ASan, both targets); and the packaged Debian image build plus its Bats suite (19 tests, 0 failures, 2 skipped). 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5 <noreply@anthropic.com>